junior-dev-struggle-bus / juniordevstrugglebus

Website for the Junior Dev Struggle Bus Meetup
https://www.juniordevstrugglebus.com
MIT License
9 stars 18 forks source link

Possible link vulnerability discovered in Header.js #36

Open Xoadra opened 4 years ago

Xoadra commented 4 years ago

Another issue I found in my console while working on #34 involves a link in the <Header /> component that's without certain recommended attributes due to its target attribute setting.

The error referenced is below:

Screen Shot 2019-10-22 at 1 15 38 AM

I'm not too familiar with this kind of security vulnerably but the warning suggested to me that I ought to make this issue known so that it can be addressed if necessary. Visit the link provided in the warning message if you want to know more.

bhurstGH commented 4 years ago

Fortunately, a pretty simple issue to tackle. We've fixed quite a few of these across the site. Great first issue/PR -- adding rel="noopener noreferrer" to the anchor/link tag solves the problem.

There's a bit more behind the issue than that (such as possible SEO concerns) but I don't think it's of much importance for us. Of course, if someone wants to get more clever about it, feel free. These two pages go a bit deeper into what's going on and why:

https://developers.google.com/web/tools/lighthouse/audits/noopener https://support.performancefoundry.com/article/186-noopener-noreferrer-on-my-links